emotet | 501286da60c316980cb0348cbcdf06027dacbb65cf967cbe6aaf0faeea26dec0

Analysis

Target
d8c06e44e78cfb31cd298ee2414ddd95.dll
Size 1004KB
Sample220315-necsvsaeh4
SHA256 501286da60c316980cb0348cbcdf06027dacbb65cf967cbe6aaf0faeea26dec0
MD5 d8c06e44e78cfb31cd298ee2414ddd95
SHA1 56a8c621b276f609581e2318f9a8575d425a8313
SHA512 bbe07317a32e3bcdfe780f548c20b0a0738fd89eed9a14064a8e17a713f6c1646bf24a3b9495de8577d672f61f023390cf23d4b85171979ae34c2520626dd392
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3748	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Vdadlcghe\mxujbgulvy.hkc	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3748	regsvr32.exe
3748	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4172	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4172	3556	regsvr32.exe	82
PID 3556 wrote to memory of 4172	3556	regsvr32.exe	82
PID 3556 wrote to memory of 4172	3556	regsvr32.exe	82
PID 4172 wrote to memory of 3748	4172	regsvr32.exe	90
PID 4172 wrote to memory of 3748	4172	regsvr32.exe	90
PID 4172 wrote to memory of 3748	4172	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d8c06e44e78cfb31cd298ee2414ddd95.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d8c06e44e78cfb31cd298ee2414ddd95.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Vdadlcghe\mxujbgulvy.hkc"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3748

memory/3748-138-0x0000000002490000-0x00000000024B8000-memory.dmp

Download

memory/4172-134-0x0000000003040000-0x0000000003068000-memory.dmp

Download